silverstripe/silverstripe-framework — pull request #2602 by chillu (2013-10-24 09:03:18+00:00)
Title: FIX Sanitize SS_HTTPResponse_Exception body (fixes #2597)

(can be merged upwards to 3.0 and 3.1 as well)

Edge case XSS prevention: The body is forced to a text/plain content type,
but proxies modifying the HTTP response or content sniffing user agents
might cause the body to be interpreted as HTML anyway.

Moved text/plain header setting into the SS_HTTPResponse_Exception constructor
in order to ensure its consistently applied.

Note: SS_HTTPResponse_Exception is mainly used through RequestHandler->httpError()

Thanks to Nathan Brauer for reporting.